At a glance
- Malaysia has committed to the OECD’s Crypto-Asset Reporting Framework (CARF), with first exchanges of crypto-asset information scheduled by 2028.
- Crypto-asset service providers will report users’ identities and transaction-level data to tax authorities, for onward exchange to LHDN.
- LHDN’s existing data channels, including e-invoicing, stamp duty records and information from foreign tax authorities, already allow it to identify mismatches between assets and declared income.
- The principal exposure for taxpayers is evidential. Positions taken on crypto gains will need to be supported by complete, reconciled records.
背景: 一个被搁置近十年的LLP
Until now, LHDN’s visibility over crypto activity has been limited. Malaysia has exchanged financial account information under the Common Reporting Standard (CRS) since 2018, but CRS applies mainly to banks and does not extend to digital asset exchanges. Crypto-asset transactions have therefore largely fallen outside automatic exchange of information.
CARF closes that gap. Developed by the OECD at the request of the G20 and finalised in 2023, it extends the principles of CRS to crypto-assets. Malaysia is among the jurisdictions that have committed to commence exchanges by 2028.
CARF does not introduce a new tax. It changes the information available to LHDN, which will increasingly be in a position to test a taxpayer’s declared position against independent third-party data.
What CARF reports
Exchanges, brokers and certain wallet providers must identify their users and report each year to their tax authority, which passes the information to the user’s country of tax residence. Transactions are reported in aggregate for each type of crypto-asset, separated by type of transaction:
Source: OECD, Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard (Section II, Reporting requirements); OECD, Step-by-step guide to implementing CARF.
Two points are often overlooked. Crypto-to-crypto conversions are reported, and under LHDN’s guidelines their treatment depends on whether the asset is held on capital or revenue account. And offshore platforms are within scope: where a provider has a reporting link to a participating jurisdiction, data on Malaysian residents reaches LHDN wherever the platform is based.
Malaysia’s timeline
The Malaysian Digital Asset Platform Association, which represents domestic exchanges, has indicated to The Edge Malaysia that its members are aware of CARF and expect implementation in 2028.
As at the date of this article, Malaysia has not published its implementing rules. These will determine the first reporting period for domestic service providers. In our view, taxpayers should plan on the basis that 2027 activity may fall within the first reporting cycle.
LHDN crypto enforcement: existing data channels
LHDN’s capacity to identify undeclared income does not depend on CARF. It has stated that it has already identified individuals with high-volume crypto transactions who were not reporting them. Its other established channels include:
The practical consequence is cumulative. A property acquisition funded by crypto proceeds is already visible through stamp duty and e-invoice data. From 2028, exchange data will be available to establish the source of those funds.
Our recommendations
CARF does not change how crypto is taxed. Under LHDN’s guidelines, gains of a capital nature remain untaxed, while trading income is taxable (see our Crypto Tax in Malaysia 2026 guide). What changes is the burden of proof. In our experience, the exposure lies less in the tax position than in the ability to support it. We recommend four steps ahead of the first reporting cycle:
- Obtain complete records. Export full transaction histories from every platform used, including dormant accounts, and map the transfers between exchanges and self-custody wallets.
- Reconcile in ringgit. Reconstruct the cost base and value each disposal, conversion and reward in RM at the transaction date.
- Confirm the tax position. Assess, with evidence, which activity is capital and which is revenue, and whether any income is foreign-sourced. Review prior years where returns may be incomplete.
- Document the source of funds. Prepare the trail that LHDN, banks and solicitors will expect before any significant conversion or property purchase.
Frequently asked questions
-
Does LHDN have visibility over my crypto?
LHDN may already identify crypto-funded activity through bank inflows, e-invoice data and property records. From 2028, under CARF, it will also receive transaction data from crypto-asset service providers in participating jurisdictions.
-
Does CARF apply to Binance, Bybit or OKX?
CARF applies to service providers with a reporting nexus in a participating jurisdiction. Users should confirm where the operating entity of their platform is established.
-
Will Malaysian exchanges request my tax details?
This is expected. Implementation is reported to require users of domestic exchanges to self-certify their tax residency and tax identification number in order to continue trading.
-
When does CARF take effect in Malaysia?
Malaysia has committed to first exchanges by 2028. The first reporting period will be confirmed in Malaysia’s implementing rules.
How can POSH help?
POSH Corporate is a licensed tax agent, chartered accountancy and company secretarial practice based in Petaling Jaya. We act for crypto-asset holders, traders, founders and Web3 businesses across tax, accounting and corporate matters.
With Malaysia’s first exchanges scheduled by 2028, taxpayers have a limited window to review their position on their own terms rather than in response to an LHDN enquiry.
To discuss your position in confidence, contact our tax team.
